The flaw in PocketMine‑MP versions before 4.2.9 allows an attacker to send inventory transaction packets that contain malformed NBT tags. Because the server does not validate the data types before deserialization, these packets can cause the server process to crash, resulting in a denial‑of‑service condition. The weakness is an input‑validation error, classified as CWE‑20.

This vulnerability affects the PocketMine‑MP server software from the pmmp vendor. All builds released prior to version 4.2.9 are susceptible. Users running older releases should verify their server version and apply an upgrade.

The CVSS score of 7.1 indicates a moderate to high severity. No EPSS data is available, but the lack of a KEV listing suggests that no publicly known exploits are documented yet. An attacker can trigger the crash by forging inventory transactions over the network, so the attack vector is remote via crafted client packets. Because the crash affects the server process, it can disrupt service for all connected clients until the server is restarted.